Release Notes for Cradlepoint Rev 6.4.0 NetCloud OS Products supported/tested AER3100/AER3150 AER2100 AER1600/AER1650 IBR1100/IBR1150 IBR900/IBR950 IBR600/IBR650 IBR600B/IBR650B IBR600C/IBR650C IBR350 CBA850 MBR1200B Note Before upgrading to new NetCloud OS, it is always a good idea to save the configuration file from your current version. This NetCloud OS version will remove a configuration for version 3.2 or lower and will not try to keep your settings. New features added in this release (Not all features are in all products see their respective Data Sheets) Auto Tunnel o Auto-Tunnel allows customers to build an optimized, resilient network on top of Cradlepoint s best in class multi-wan solutions. Networks using auto-tunnel can seamlessly switch between WAN sources, providing the best customer experience with virtually zero downtime. This transparent failover can be coupled with all Cradlepoint s Traffic Control functionality to optimize the link in use for the best customer experience. On top of all the end user benefits, auto-tunnel is dramatically simpler to setup than the typical IPSec VPN. 1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 Toll Free: +1 855-813-3385 Local: +1 208-424-5054 Cradlepoint.com Page: 1
o Benefits Prevents downtime as networks failover between links Removal of any dead zones in coverage Optimized performance of network Simple to set up Secure connectivity Webroot Content Filtering o An alternative to Zscaler for customers who do not require Anti-Malware functionality. o Configured on the router o Provides a pathway to enhanced client analytics IPv6 Support o Support for dual-stack (IPv4 and IPv6) was added to these router features: GRE Content Filtering VPN Tunnels NTP SSH Hop Remote Access WebAccess WebFilter Zscaler OpenDNS DNS Proxy VRRP Firewall WAN/LAN NAT Chains SNMP WAN USB to Serial VTI Japan Wi-Fi Support for IBR900 and AER1600 (6.3.3) Added Threat Management support to IBR9x0 and IBR6x0C. This is enabled under the Security -> Threat Management menu. This is a licensable feature and is not enabled by default. Introduced Connection Sets in Connection Manager. Used to define a group of interfaces that connects or disconnects all interfaces as a set whenever a member of the group connects or disconnects due to the configured priority rules. When enabled, Connection Sets overlay load balance configurations. Introduced Connection State in Connection Manager. Used to configure the profile/interface to Always On, Standby and Connect as needed, replacing the Standby checkbox. 1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 Toll Free: +1 855-813-3385 Local: +1 208-424-5054 Cradlepoint.com Page: 2
LP6/LP5/LPE/LP3 only. Added support for multiple PDNs as supported on certain SIMs. With appropriately provisioned SIMs allows a single modem to simultaneously support multiple WAN interface/connections (PDNs) each with their own unique IP address. SIMs of this type are used for split billing, public/private network traffic, and other features. (AER) WiFi SSID now supports Unicode characters. Additional UI/Usability changes NetCloud rebranding, the router UI reflects the NetCloud OS (which used to be referred to as router firmware) and NetCloud (which used to be referred to as ECM) rebranding. Added Status and Config pages for Auto Tunnel feature Added additional IPv6 dual stack options to Connection Manager Modified WAN Verify Idle Check Interval from minimum of 10 secs to 2 secs (T-Mobile) LP4/LP5 only. Added carrier / PDN authentication (user name / password credential options) to these modems: Connection Manager>profile/interface>Edit>SIM/APN/Auth LP6/LP5 only: Added ability to disable Carrier Aggregation (enabled by default). Connection Manager>profile/interface>Edit>Modem>Show Advanced Settings LP6/LPE only. Added Sprint M2M SIM account type support. LP5 only. Added support for DHCP relay and voice reject options: Connection Manager>profile/interface>Edit>Modem>Show Advanced Settings Defects fixed Fixed an issue with device alerts where the alert queue would stall if the WAN went down while sending an email. Improvements made to Threat Management to avoid triggering the watchdog timer. Fixed a core config store line in the PUT path that ensures no uuid's in paths for callbacks. This was causing a problem where NCM would send down uuid's in path (that aren't the leaf) that would cause config suspend with validators that don't expect uuid's. Needed to re-write portions of the Zscaler service to resolve race conditions and state machine problems that were causing service disruptions at some customer sites. An upgrade to the internal web server for the previous version of NetCloud OS caused hotspot to stop working in some corner cases. This was fixed. Configuring the inactivity timeout for the IBR350 caused the ipsec vpn tunnel not to initiate as expected during WAN failover. Changes to improve the user experience when policy based routing are used in conjunction with VRRP. Enhanced the BGPPeers SDK app to work around a bug in firmware version 6.2 where the LAN networks would disappear after switching routers in VRRP. Dual SIM management improvements. o Modem AT config script entry is now possible modems that have both SIM interfaces enabled. o Resolved router reboot if issue with modem hard reset with dual SIMs. 1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 Toll Free: +1 855-813-3385 Local: +1 208-424-5054 Cradlepoint.com Page: 3
o Better recovery from unexpected plug in download mode. o Optimized the controller with HW SIM presence detection o Bypass configuration of 2 nd SIM slot if no SIM is present LP5 only. Edit of modem profile or interface is now allowed after editing the 1 st time. LP4 only. Miscellaneous improvements to the driver, such as better stability if in a dock, now replugs properly if there is a failure after SIM switching Modem TAC number is now attainable in the status tree via CLI command. This value applies only to LTE connections. LPE/LP3 only. T-Mobile dynamic IP voices SIMs no longer overwrite the MDN with 411. Resolved UI display where SIM PIN/PUK status and counts were not in sync (AER31x0) PoE devices on power up would not use maximum power available. PSE should support four Class III devices on 60W budget. (IBR1100) Clients not able to connect to 5GHz when Channel Width set to 20/40/80 MHz Auto. WiFi-as-WAN EAP-TLS not working correctly or possible misconfiguration of NPS on Windows Server. We made changes in the UI to allow setting the Username/Identity that Windows Server required. Note that it should be the same Identity as the Certificate. Resolved GPS memory leak that resulted in Out of Memory router messages. Added modem workaround for SIMs with delayed connection interaction. (IBR1100) RADIUS fails to authenticate on reboot until WiFi radio is disabled/enabled. Security issues Updated OpenSSL to 1.0.1u (IBR900) Client wifi connectivity issues. Even though wpa2 is enabled the selected network is open on the client. The IBR900 UI allowed a user to configure WPA1 ( WPA/WPA2 Personal in UI) and enable Protected Management Frames (PMF). These settings are mutually exclusive and caused the security mode to be set to Open instead of WPA1. A change was made to not enable both of these settings; PMF can only be enabled when using WPA2 security. Modems tested (new 6.4.0 modems / modem platforms are in blue text) Cradlepoint Cellular Devices (Embedded & USB Modems) Cradlepoint AER16x0LPE-AT / AT&T (USA) Cradlepoint AER16x0LPE-GN / T-Mobile, US Cellular (USA); Generic (North America) Cradlepoint AER16x0LPE-SP / Sprint (USA) Cradlepoint AER16x0LPE-VZ / Verizon (USA) Cradlepoint AER16x0LP4 / AT&T, T-Mobile, Verizon (USA) 1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 Toll Free: +1 855-813-3385 Local: +1 208-424-5054 Cradlepoint.com Page: 4
Cradlepoint IBR350L / Verizon (USA) Cradlepoint IBR350LPE-AT / AT&T (USA) Cradlepoint IBR350LPE-GN / T-Mobile (USA); Generic (North America) Cradlepoint IBR350LPE-SP/ Sprint (USA) Cradlepoint IBR350LPE-VZ / Verizon (USA) Cradlepoint IBR350P2 / AT&T (USA); Generic GSM-compatible locations (World) Cradlepoint IBR6x0B-LP4 / AT&T, T-Mobile, Verizon (USA) Cradlepoint IBR6x0C-LPE-AT / AT&T (USA) Cradlepoint IBR6x0C-LPE-GN / T-Mobile (USA); Generic (North America) Cradlepoint IBR6x0C-LPE-SP/ Sprint (USA) Cradlepoint IBR6x0C-LPE-VZ / Verizon (USA) Cradlepoint IBR6x0LPE-AT / AT&T (USA) Cradlepoint IBR6x0LPE-GN / T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada); Generic (North America) Cradlepoint IBR6x0LPE-SP/ Sprint (USA) Cradlepoint IBR6x0LPE-VZ / Verizon (USA) Cradlepoint IBR6x0LP3-EU / Generic (Europe) Cradlepoint IBR900LPE-VZ / Verizon (USA) Note: Also certified on AT&T (USA), Sprint (USA), and Generic (North America) Cradlepoint IBR9x0LP5 / Generic (APAC) Cradlepoint IBR9x0LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe) Cradlepoint IBR11x0LPE-AT / AT&T (USA) Cradlepoint IBR11x0LPE-GN / C-Spire, T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada); Generic (North America) Cradlepoint IBR11x0LPE-SP / Sprint (USA) Cradlepoint IBR11x0LPE-VZ / Verizon (USA Cradlepoint IBR11x0LP3-EU / Generic (Europe), Telstra (Australia) Cradlepoint IBR11x0LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Generic (North America, Europe) Cradlepoint MC400L2 / Public Safety Band 14 only (USA) Cradlepoint MC400LPE-AT / AT&T (USA) 1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 Toll Free: +1 855-813-3385 Local: +1 208-424-5054 Cradlepoint.com Page: 5
Cradlepoint MC400LPE-GN / T-Mobile, US Cellular (USA); Bell Mobility, Rogers, Telus (Canada); Generic (North America) Cradlepoint MC400LPE-SP / Sprint (USA) Cradlepoint MC400LPE-VZ / Verizon (USA) Cradlepoint MC400LP3-EU / Generic (Europe) Cradlepoint MC400LP4 / AT&T, T-Mobile, Verizon (USA) Cradlepoint MC400LP5 / Generic (APAC) Cradlepoint MC400LP6 / AT&T, Sprint, T-Mobile, Verizon (USA); Vodafone (Worldwide), Generic (North America, Europe) 3 rd Party USB Cellular Modems Franklin U770 ( Sprint Plug-In-Connect Tri-Mode USB Modem ) / Sprint (USA) Franklin U772 ( Franklin U772 USB Modem ) / Sprint (USA) Huawei E3276 / Telus (Canada) Huawei E368 ( AT&T USBConnect Force 4G ) / AT&T (USA) Netgear AC340U ( AT&T Beam ) / AT&T (USA) Netgear AC341U ( NETGEAR 341U USB Modem ) / Sprint (USA) *supports Netgear firmware 4.07.01.11 and MR2 firmware 45.04.20.00 Novatel 551L LTE ( Verizon USB551L ) / Verizon (USA) Novatel U620L ( Verizon MiFi 4G LTE Global USB Modem U620L ) / Verizon (USA) Novatel U679 ( 4G LTE Novatel Wireless U679 Turbo Stick ) / Bell Mobility (Canada) Pantech UML295VW ( Verizon 4G LTE USB Modem UML2954G LTE ) / Verizon (USA) *requires Pantech firmware version L0295VWD821F.B4 or later Portsmith PSA1U1M ("Portsmith USB Client to Analog Modem Adapter") / POTS phone providers Sierra Wireless 308 USB ( AT&T USBConnect Shockwave ) / AT&T (USA) Sierra Wireless 313U ( AT&T USBConnect Momentum 4G ) / AT&T (USA) Sierra Wireless 320U ( Telstra USB 4G (Sierra AirCard 320U) ) / Telstra (Australia) Sierra Wireless 330U ( 4G LTE Sierra Wireless U330 - Turbo Stick ) / Bell Mobility (Canada) Sierra Wireless 330U ( LTE Rocket Stick Sierra Wireless AirCard 330U ) / Rogers (Canada) ZTE MF683 ( T-Mobile Rocket 3.0 4G Laptop Stick ) / T-Mobile (USA) 1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 Toll Free: +1 855-813-3385 Local: +1 208-424-5054 Cradlepoint.com Page: 6
Analog Modems Portsmith PSA1U1M ( Portsmith USB Client to Analog Modem Adapter ) / POTS phone providers Portsmith PS6EX1M ("Portsmith ExCard to Analog Modem Adapter ) / POTS phone providers (ExpressCard format, compatible with MBR1400s, MBR1200B, & CBA750B only) Known issues VTI LTE A known issue exists around connecting two Cradlepoint devices using VTI if using an IPv6 address as the remote gateway and using IPv4 for the virtual tunnel interface IP. As a workaround use IPv6 as the internal VTI IP. Unless you have a specific service from your carrier, LTE modems will not generally provide an externally-available IP address. Services, such as Remote Management, will not work. Modem Franklin U770. The Modem s Ethernet address conflicts with the default address of the Guest LAN. A warning message is placed in the log and the Guest LAN is disabled. If you change the address of the Guest LAN to a non-conflicting address, this restriction will not occur. Sierra Wireless 313U and 330U. When these modems connect on 2G or 3G bands, specifically on GSM 850, they will sometimes cause interference on the USB bus, resulting in the modem not plugging properly. If this occurs, attaching the modem to a USB extension cable will generally fix the problem. The following USB modems contain an embedded web server through which many modem settings are configured. To access the modem s web pages, you must be logged in as the router administrator. Once logged in, you can then access the modem web pages at these given IP addresses: Franklin U770, U772 / Sprint (USA) -> 192.168.10.1 Netgear AC341U * / Sprint (USA) -> 192.168.1.1 (address is configurable) Pantech UML295VW * / Verizon (USA) -> 192.168.32.2 * The modem web pages are available only when the modem is operating in NAT mode. 1111 W Jefferson Street, Ste. 400, Boise, ID 83702-5389 Toll Free: +1 855-813-3385 Local: +1 208-424-5054 Cradlepoint.com Page: 7